Refactor SSH configuration and playbook execution in ansible-apply.yaml

.github/workflows/terraform-k8apps-apply.yaml

@@ -6,6 +6,7 @@ on:
       - main
     paths:
       - "terraform/k8sapps/**"
+      - .github/workflows/terraform-k8apps-apply.yaml
 
 jobs:
   apply:
@@ -22,8 +23,61 @@ jobs:
 
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
-        with:
-          version: 0.0.3
+
+      - name: Install Python and required packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-pip
+          python3 -m pip install -r requirements.txt
+
+      - name: Setup SSH Key
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          sectool ssh unlock ansible
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
+          chmod 600 ~/.ssh/id_ecdsa
+
+      - name: Read SSH Trusted Hosts keys
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        run: |
+          mkdir -p ~/.ssh
+          for HOST in $TRUSTED_HOSTS; do
+            ssh-keyscan $HOST >> ~/.ssh/known_hosts
+          done
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Start SSH Agent
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
+          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
+          rm ~/.ssh_askpass
+
+      - name: Check SSH Connection
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          for HOST in $TRUSTED_HOSTS; do
+            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+          done
+
+      - name: Copy Kube Config from remote host
+        env:
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          mkdir -p ~/.kube
+          ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
 
       - name: Terraform Init
         env:

.github/workflows/terraform-k8apps-validate.yaml

@@ -6,12 +6,13 @@ on:
       - main
     paths:
       - "terraform/k8sapps/**"
+      - .github/workflows/terraform-k8apps-validate.yaml
     types:
       - opened
       - synchronize
       - reopened
 jobs:
-  plan:
+  apply:
     runs-on: ubuntu-latest
 
     steps:
@@ -26,6 +27,61 @@ jobs:
       - name: Setup Sectool
         uses: a13labs/setup-sectool@v1
 
+      - name: Install Python and required packages
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y python3-pip
+          python3 -m pip install -r requirements.txt
+
+      - name: Setup SSH Key
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+        run: |
+          sectool ssh unlock ansible
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          cp ssh-keys/ansible/id_ecdsa ~/.ssh/id_ecdsa
+          chmod 600 ~/.ssh/id_ecdsa
+
+      - name: Read SSH Trusted Hosts keys
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+        run: |
+          mkdir -p ~/.ssh
+          for HOST in $TRUSTED_HOSTS; do
+            ssh-keyscan $HOST >> ~/.ssh/known_hosts
+          done
+          chmod 600 ~/.ssh/known_hosts
+
+      - name: Start SSH Agent
+        env:
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          ssh-agent -a $SSH_AUTH_SOCK > /dev/null
+          echo 'sectool vault get SSH_PASSWORD' > ~/.ssh_askpass && chmod +x ~/.ssh_askpass
+          DISPLAY=None SSH_ASKPASS=~/.ssh_askpass ssh-add ~/.ssh/id_ecdsa < /dev/null
+          rm ~/.ssh_askpass
+
+      - name: Check SSH Connection
+        env:
+          TRUSTED_HOSTS: ${{ secrets.TRUSTED_HOSTS }}
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          for HOST in $TRUSTED_HOSTS; do
+            ssh $ANSIBLE_USER@$HOST echo "SSH connection to $HOST successful"
+          done
+
+      - name: Copy Kube Config from remote host
+        env:
+          ANSIBLE_USER: ${{ secrets.ANSIBLE_USER }}
+          VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
+          SSH_AUTH_SOCK: /tmp/ssh_agent.sock
+        run: |
+          mkdir -p ~/.kube
+          ansible -i ansible/inventory/hosts -m fetch -a "src=/home/$ANSIBLE_USER/.kube/config dest=~/.kube/config flat=yes" microk8s
+
       - name: Terraform Init
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
@@ -33,7 +89,7 @@ jobs:
           cd terraform/k8sapps
           sectool exec terraform init
 
-      - name: Terraform Plan
+      - name: Terraform Apply
         env:
           VAULT_MASTER_PASSWORD: ${{ secrets.VAULT_MASTER_PASSWORD }}
         run: |